If those sites hijacking your code aren't actually linking to you, then the visits that show as referred by them are presumably visits staying on those spam sit

If those sites hijacking your code aren't actually linking to you, then the visits that show as referred by them are presumably visits staying on those spam sites. In which case by filtering out those visits, you'll also filter out the referral sources for those visits, no? (It's been a while since Analytics was anywhere near my personal work, so could be wrong here.)